- Jun 15, 2021
-
-
Gerd Hoffmann authored
Free in correct order to avoid use-after-free. Resolves: CID 1453812 Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by:
Li Qiang <liq3ea@gmail.com> Reviewed-by:
Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210604103714.1237414-1-kraxel@redhat.com>
-
- May 27, 2021
-
-
Li Qiang authored
Currently in vhost-user-gpu, we free resource directly in the cleanup case of resource. If we change the cleanup logic we need to change several places, also abstruct a 'vg_create_mapping_iov' can be symmetry with the 'vg_create_mapping_iov'. This is like what virtio-gpu does, no function changed. Signed-off-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-9-liq3ea@163.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Li Qiang authored
If 'virgl_cmd_get_capset' set 'max_size' to 0, the 'virgl_renderer_fill_caps' will write the data after the 'resp'. This patch avoid this by checking the returned 'max_size'. virtio-gpu fix: abd7f08b ("display: virtio-gpu-3d: check virgl capabilities max_size") Fixes: CVE-2021-3546 Reported-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-8-liq3ea@163.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Li Qiang authored
If 'virgl_renderer_resource_attach_iov' failed, the 'res_iovs' will be leaked. Fixes: CVE-2021-3544 Reported-by:
Li Qiang <liq3ea@163.com> virtio-gpu fix: 33243031 ("virtio-gpu-3d: fix memory leak in resource attach backing") Signed-off-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-7-liq3ea@163.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Li Qiang authored
The 'res->iov' will be leaked if the guest trigger following sequences: virgl_cmd_create_resource_2d virgl_resource_attach_backing virgl_cmd_resource_unref This patch fixes this. Fixes: CVE-2021-3544 Reported-by:
Li Qiang <liq3ea@163.com> virtio-gpu fix: 5e8e3c4c ("virtio-gpu: fix resource leak in virgl_cmd_resource_unref" Signed-off-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-6-liq3ea@163.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Li Qiang authored
If the guest trigger following sequences, the attach_backing will be leaked: vg_resource_create_2d vg_resource_attach_backing vg_resource_unref This patch fix this by freeing 'res->iov' in vg_resource_destroy. Fixes: CVE-2021-3544 Reported-by:
Li Qiang <liq3ea@163.com> virtio-gpu fix: 5e8e3c4c ("virtio-gpu: fix resource leak in virgl_cmd_resource_unref") Reviewed-by:
Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-5-liq3ea@163.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Li Qiang authored
Check whether the 'res' has already been attach_backing to avoid memory leak. Fixes: CVE-2021-3544 Reported-by:
Li Qiang <liq3ea@163.com> virtio-gpu fix: 204f01b3 ("virtio-gpu: fix memory leak in resource attach backing") Signed-off-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-4-liq3ea@163.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Li Qiang authored
Call 'vugbm_buffer_destroy' in error path to avoid resource leak. Fixes: CVE-2021-3544 Reported-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-3-liq3ea@163.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Li Qiang authored
Otherwise some of the 'resp' will be leaked to guest. Fixes: CVE-2021-3545 Reported-by:
Li Qiang <liq3ea@163.com> virtio-gpu fix: 42a8dadc ("virtio-gpu: fix information leak in getting capset info dispatch") Signed-off-by:
Li Qiang <liq3ea@163.com> Reviewed-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210516030403.107723-2-liq3ea@163.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
- May 14, 2021
-
-
Fabrice Fontaine authored
time element is deprecated on new input_event structure in kernel's input.h [1] This will avoid the following build failure: hw/input/virtio-input-host.c: In function 'virtio_input_host_handle_status': hw/input/virtio-input-host.c:198:28: error: 'struct input_event' has no member named 'time' 198 | if (gettimeofday(&evdev.time, NULL)) { | ^ Fixes: - http://autobuild.buildroot.org/results/a538167e288c14208d557cd45446df86d3d599d5 - http://autobuild.buildroot.org/results/efd4474fb4b6c0ce0ab3838ce130429c51e43bbb [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=152194fe9c3f Signed-off-by:
Fabrice Fontaine <fontaine.fabrice@gmail.com> Message-Id: <20201203195819.583626-1-fontaine.fabrice@gmail.com> Fixes: https://gitlab.com/qemu-project/qemu/-/issues/246 Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
- Mar 26, 2021
-
-
Marc-André Lureau authored
"move" is incorrectly initialized. Fix it by using a switch statement and also treating unknown commands with a fallback. Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210312100108.2706195-5-marcandre.lureau@redhat.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Marc-André Lureau authored
vugbm implements GBM device wrapping, udmabuf and memory fallback. However, the fallback/detection logic is flawed, as if "/dev/udmabuf" failed to be opened, it will not initialize vugbm and crash later. Rework the vugbm_device_init() logic to initialize correctly in all cases. Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210312100108.2706195-4-marcandre.lureau@redhat.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Marc-André Lureau authored
For similar reasons as commit 3af16718 ("spice: flush on GL update before notifying client"), vhost-user-gpu must ensure the GL state is flushed before sharing its rendering result. Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210312100108.2706195-3-marcandre.lureau@redhat.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
- Mar 20, 2021
-
-
David CARLIER authored
sun is a macro on these systems, thus renaming the variables on the client and server. Signed-off-by:
David Carlier <devnexen@gmail.com> Message-Id: <CA+XhMqzHPG5ezqY-YxbA+tMoadA3VDFWBX8_LaLC5YsQOMrz+A@mail.gmail.com> Reviewed-by:
Peter Maydell <peter.maydell@linaro.org> Signed-off-by:
Thomas Huth <thuth@redhat.com>
-
- Mar 17, 2021
-
-
Aaron Lindsay authored
This allows plugins to query for full virtual-to-physical address translation for a given `qemu_plugin_hwaddr` and stops exposing the offset within the device itself. As this change breaks the API, QEMU_PLUGIN_VERSION is incremented. Signed-off-by:
Aaron Lindsay <aaron@os.amperecomputing.com> Signed-off-by:
Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210309202802.211756-1-aaron@os.amperecomputing.com> Message-Id: <20210312172821.31647-3-alex.bennee@linaro.org>
-
- Feb 18, 2021
-
-
zhouyang authored
I found some style problems whil check the code using checkpatch.pl. This commit fixs the issue below: ERROR: that open brace { should be on the previous line Signed-off-by:
zhouyang <zhouyang789@huawei.com> Signed-off-by:
Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210118031004.1662363-6-zhouyang789@huawei.com> Message-Id: <20210213130325.14781-9-alex.bennee@linaro.org>
-
zhouyang authored
I am reading contrib related code and found some style problems while check the code using checkpatch.pl. This commit fixs the issue below: ERROR: space required after that ',' Signed-off-by:
zhouyang <zhouyang789@huawei.com> Signed-off-by:
Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210118031004.1662363-5-zhouyang789@huawei.com> Message-Id: <20210213130325.14781-8-alex.bennee@linaro.org>
-
zhouyang authored
I am reading contrib related code and found some style problems while check the code using checkpatch.pl. This commit fixs the issue below: ERROR: spaces required around that '*' Signed-off-by:
zhouyang <zhouyang789@huawei.com> Signed-off-by:
Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210118031004.1662363-4-zhouyang789@huawei.com> Message-Id: <20210213130325.14781-7-alex.bennee@linaro.org>
-
zhouyang authored
I am reading contrib related code and found some style problems while check the code using checkpatch.pl. This commit fixs the issue below: ERROR: "foo * bar" should be "foo *bar" Signed-off-by:
zhouyang <zhouyang789@huawei.com> Signed-off-by:
Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210118031004.1662363-3-zhouyang789@huawei.com> Message-Id: <20210213130325.14781-6-alex.bennee@linaro.org>
-
zhouyang authored
I am reading contrib related code and found some style problems while check the code using checkpatch.pl. This commit fixs the misuse of '#' flag of printf format Signed-off-by:
zhouyang <zhouyang789@huawei.com> Signed-off-by:
Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210118031004.1662363-2-zhouyang789@huawei.com> Message-Id: <20210213130325.14781-5-alex.bennee@linaro.org>
-
Alex Bennée authored
This is a plugin intended to help with profiling access to various bits of system hardware. It only really makes sense for system emulation. It takes advantage of the recently exposed helper API that allows us to see the device name (memory region name) associated with a device. You can specify arg=read or arg=write to limit the tracking to just reads or writes (by default it does both). The pattern option: -plugin ./tests/plugin/libhwprofile.so,arg=pattern will allow you to see the access pattern to devices, eg: gic_cpu @ 0xffffffc010040000 off:00000000, 8, 1, 8, 1 off:00000000, 4, 1, 4, 1 off:00000000, 2, 1, 2, 1 off:00000000, 1, 1, 1, 1 The source option: -plugin ./tests/plugin/libhwprofile.so,arg=source will track the virtual source address of the instruction making the access: pl011 @ 0xffffffc010031000 pc:ffffffc0104c785c, 1, 4, 0, 0 pc:ffffffc0104c7898, 1, 4, 0, 0 pc:ffffffc010512bcc, 2, 1867, 0, 0 You cannot mix source and pattern. Finally the match option allow you to limit the tracking to just the devices you care about. Signed-off-by:
Alex Bennée <alex.bennee@linaro.org> Tested-by:
Robert Foley <robert.foley@linaro.org> Reviewed-by:
Robert Foley <robert.foley@linaro.org> Message-Id: <20210213130325.14781-4-alex.bennee@linaro.org>
-
- Feb 04, 2021
-
-
Marc-André Lureau authored
Fixes a deadlock where the backend calls QEMU, while QEMU also calls the backend simultaneously, both ends waiting for each other. Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-5-marcandre.lureau@redhat.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Marc-André Lureau authored
Introduce a pending state for commands which aren't finished yet, but are being handled. See following patch. Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by:
Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210204105232.834642-4-marcandre.lureau@redhat.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
Marc-André Lureau authored
Fixes a deadlock where the backend calls QEMU, while QEMU also calls the backend simultaneously, both ends waiting for each other. Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20210204105232.834642-3-marcandre.lureau@redhat.com> Signed-off-by:
Gerd Hoffmann <kraxel@redhat.com>
-
- Jan 20, 2021
-
-
Jiaxun Yang authored
As per POSIX specification of limits.h [1], OS libc may define PAGE_SIZE in limits.h. To prevent collosion of definition, we rename PAGE_SIZE here. [1]: https://pubs.opengroup.org/onlinepubs/7908799/xsh/limits.h.html Signed-off-by:
Jiaxun Yang <jiaxun.yang@flygoat.com> Reviewed-by:
Thomas Huth <thuth@redhat.com> Reviewed-by:
Philippe Mathieu-Daudé <philmd@redhat.com> Message-Id: <20210118063808.12471-6-jiaxun.yang@flygoat.com> Signed-off-by:
Thomas Huth <thuth@redhat.com>
-
- Jan 02, 2021
-
-
Paolo Bonzini authored
Signed-off-by:
Paolo Bonzini <pbonzini@redhat.com>
-
Paolo Bonzini authored
Reviewed-by:
Daniel Berrangé <berrange@redhat.com> Signed-off-by:
Paolo Bonzini <pbonzini@redhat.com>
-
- Dec 18, 2020
-
-
Alex Chen authored
When fd is not found according to ifid, the _hash_tbl_search_fd_by_ifid() returns 0 and assigns the result to *fd, so We have to check that *fd is 0, not that fd is 0. Reported-by:
Euler Robot <euler.robot@huawei.com> Signed-off-by:
AlexChen <alex.chen@huawei.com> Message-Id: <5F9AC6FF.4000301@huawei.com> Reviewed-by:
Marcel Apfelbaum <marcel.apfelbaum@gmail.com> Signed-off-by:
Marcel Apfelbaum <marcel.apfelbaum@gmail.com>
-
- Dec 13, 2020
-
-
Pan Nengyuan authored
Missing g_error_free in pdb_init_from_file() error path. Fix that. Reported-by:
Euler Robot <euler.robot@huawei.com> Signed-off-by:
Pan Nengyuan <pannengyuan@huawei.com> Reviewed-by:
Viktor Prutyanov <viktor.prutyanov@phystech.edu> Reviewed-by:
Li Qiang <liq3ea@gmail.com> Signed-off-by:
Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by:
Thomas Huth <thuth@redhat.com> Message-Id: <20201023061218.2080844-5-kuhn.chenqun@huawei.com> Signed-off-by:
Laurent Vivier <laurent@vivier.eu>
-
Pan Nengyuan authored
Missing g_error_free in QEMU_Elf_init() error path. Fix that. Reported-by:
Euler Robot <euler.robot@huawei.com> Signed-off-by:
Pan Nengyuan <pannengyuan@huawei.com> Reviewed-by:
Viktor Prutyanov <viktor.prutyanov@phystech.edu> Reviewed-by:
Li Qiang <liq3ea@gmail.com> Signed-off-by:
Chen Qun <kuhn.chenqun@huawei.com> Reviewed-by:
Thomas Huth <thuth@redhat.com> Message-Id: <20201023061218.2080844-4-kuhn.chenqun@huawei.com> Signed-off-by:
Laurent Vivier <laurent@vivier.eu>
-
- Dec 10, 2020
-
-
Markus Armbruster authored
Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes, with the changes to the following files manually reverted: contrib/libvhost-user/libvhost-user-glib.h contrib/libvhost-user/libvhost-user.c contrib/libvhost-user/libvhost-user.h contrib/plugins/hotblocks.c contrib/plugins/hotpages.c contrib/plugins/howvec.c contrib/plugins/lockstep.c linux-user/mips64/cpu_loop.c linux-user/mips64/signal.c linux-user/sparc64/cpu_loop.c linux-user/sparc64/signal.c linux-user/x86_64/cpu_loop.c linux-user/x86_64/signal.c target/s390x/gen-features.c tests/fp/platform.h tests/migration/s390x/a-b-bios.c tests/plugin/bb.c tests/plugin/empty.c tests/plugin/insn.c tests/plugin/mem.c tests/test-rcu-simpleq.c tests/test-rcu-slist.c tests/test-rcu-tailq.c tests/uefi-test-tools/UefiTestToolsPkg/BiosTablesTest/BiosTablesTest.c contrib/plugins/, tests/plugin/, and tests/test-rcu-slist.c appear not to include osdep.h intentionally. The remaining reverts are the same as in commit bbfff196. Signed-off-by:
Markus Armbruster <armbru@redhat.com> Message-Id: <20201113061216.2483385-1-armbru@redhat.com> Acked-by:
Paolo Bonzini <pbonzini@redhat.com> Acked-by:
Dr. David Alan Gilbert <dgilbert@redhat.com> Tested-by:
Thomas Huth <thuth@redhat.com> Acked-by:
Cornelia Huck <cohuck@redhat.com> Acked-by:
Michael S. Tsirkin <mst@redhat.com> Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Acked-by:
Alexander Bulekov <alxndr@bu.edu>
-
- Dec 09, 2020
-
-
Stefan Hajnoczi authored
Do not validate input with g_return_val_if(). This API is intended for checking programming errors and is compiled out with -DG_DISABLE_CHECKS. Use an explicit if statement for input validation so it cannot accidentally be compiled out. Suggested-by:
Markus Armbruster <armbru@redhat.com> Signed-off-by:
Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20201118091644.199527-4-stefanha@redhat.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
Stefan Hajnoczi authored
Do not validate input with g_return_val_if(). This API is intended for checking programming errors and is compiled out with -DG_DISABLE_CHECKS. Use an explicit if statement for input validation so it cannot accidentally be compiled out. Suggested-by:
Markus Armbruster <armbru@redhat.com> Signed-off-by:
Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20201118091644.199527-3-stefanha@redhat.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
Stefan Hajnoczi authored
Do not validate input with g_return_val_if(). This API is intended for checking programming errors and is compiled out with -DG_DISABLE_CHECKS. Use an explicit if statement for input validation so it cannot accidentally be compiled out. Suggested-by:
Markus Armbruster <armbru@redhat.com> Signed-off-by:
Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20201118091644.199527-2-stefanha@redhat.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
- Dec 08, 2020
-
-
Marc-André Lureau authored
By making libvhost-user a subproject, check it builds standalone (without the global QEMU cflags etc). Note that the library still relies on QEMU include/qemu/atomic.h and linux_headers/. Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20201125100640.366523-6-marcandre.lureau@redhat.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
Marc-André Lureau authored
Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20201125100640.366523-5-marcandre.lureau@redhat.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
Marc-André Lureau authored
Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Message-Id: <20201125100640.366523-4-marcandre.lureau@redhat.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
Marc-André Lureau authored
Undo the damage from commit 5f9ff1ef ("libvhost-user: Support tracking inflight I/O in shared memory") which introduced glib dependency through osdep.h inclusion. libvhost-user.c tries to stay free from glib usage. Use glibc memfd_create directly when available (assumed so when MFD_ALLOW_SEALING is defined). A following commit will make the project standalone and check for memfd API at configure time, instead of a panic at runtime. Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20201125100640.366523-3-marcandre.lureau@redhat.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
Marc-André Lureau authored
Signed-off-by:
Marc-André Lureau <marcandre.lureau@redhat.com> Reviewed-by:
Dr. David Alan Gilbert <dgilbert@redhat.com> Reviewed-by:
Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20201125100640.366523-2-marcandre.lureau@redhat.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-
Alex Chen authored
The 'elem' is allocated memory in vu_queue_pop(), and its memory should be freed in all error branches after vu_queue_pop(). In addition, in order to free the 'elem' memory outside of while(1) loop, move the definition of 'elem' to the beginning of vus_proc_req(). Reported-by:
Euler Robot <euler.robot@huawei.com> Signed-off-by:
Alex Chen <alex.chen@huawei.com> Reviewed-by:
Raphael Norwitz <raphael.norwitz@nutanix.com> Message-Id: <20201125013055.34147-1-alex.chen@huawei.com> Reviewed-by:
Michael S. Tsirkin <mst@redhat.com> Signed-off-by:
Michael S. Tsirkin <mst@redhat.com>
-